Analysis

IBM Langflow OSS versions 1.0.0 through 1.9.3 are affected by CVE-2026-10134, a code injection issue (CWE-94) scored 10.0 under CVSS 3.1 by the CNA. The record describes access to secrets and stored data, movement across tenants, and persistence through modified public flows. No fixed version is listed in the record, so teams should check the vendor advisory and restrict exposure until a fix is confirmed.

CVE-2026-56036 describes an unauthenticated SQL injection (CWE-89) affecting 워드프레스 결제 심플페이 in versions up to and including 5.5.6. The record carries a CVSS 3.1 base score of 9.3 (critical) from audit@patchstack.com, but no structured affected or fixed version list is available. No confirmed exploitation appears in the sources consulted.

Privasys Go, a Go language fork that adds RA-TLS support, has a flaw in challenge-mode RA-TLS certificates prior to privasys-v0.5.1-go1.26.5. Attestation quotes were bound to the certificate key and client nonce but not to the active TLS session, which allows a genuine quote to be relayed onto another connection. The record assigns a critical severity with CVSS 4.0 score 9.1 and shows no KEV listing.

An unauthenticated SQL injection flaw (CWE-89) affects wpDataTables 7.4 and earlier, as described in the record. The CNA Patchstack scored it 9.3 (critical) under CVSS 3.1. The record lists no fixed version and no confirmed exploitation in the sources consulted.

A PHP Object Injection weakness (CWE-502) in the BuddyBoss Platform WordPress plugin affects versions up to and including 3.0.4, according to the record. Patchstack, the CNA, scored it 9.8 (critical) under CVSS 3.1, but the title-level description names the Subscriber role while the vector lists no privileges required, a point that remains unresolved. No fixed version or structured affected-version list appears in the sources consulted, so site owners should verify their installed version with the vendor or Patchstack.

CVE-2026-46386 affects the official openproject/openproject Docker image, which according to the record ships a default placeholder value for the Rails secret key base. Combined with Marshal cookie serialization, the record describes a path that lets any logged-in user reach unsafe deserialization. The CNA rates it 9.9 (CVSS 3.1, critical), but the record lacks affected and fixed version data.

Delta Electronics DVP12SE PLCs are susceptible to CWE-770, allocation of resources without limits or throttling, in their Modbus TCP service. The record carries a CVSS 4.0 base score of 9.3 (critical) from the CNA, with a network attack vector and no privileges or user interaction required. The record is not listed in CISA KEV, no confirmed exploitation appears in the sources consulted, and it lists no affected versions or fixes.

CVE-2026-56067 describes an unauthenticated SQL injection flaw in JetSmartFilters versions up to and including 3.8.3. The CNA audit@patchstack.com assigned a CVSS 3.1 base score of 9.3 (critical), and the record maps the issue to CWE-89. The record includes no fixed version or structured affected-version list, and it is not listed in CISA KEV.

CVE-2026-54831 is an unauthenticated SQL injection flaw in the GeoDirectory WordPress plugin, affecting versions up to and including 2.8.162 according to the record. The CNA Patchstack assigned a CVSS 3.1 base score of 9.3 (Critical) with a network attack vector and no privileges required. No KEV listing or confirmed exploitation appears in the sources consulted, and the record does not list a fixed version.

CVE-2026-48281 is a critical Improper Input Validation issue (CWE-20) in Adobe ColdFusion that, according to the record, could allow arbitrary code execution in the context of the current user. The CVSS 3.1 base score is 10.0, with network attack vector, no privileges or user interaction required, and a changed scope. The record shows no CISA KEV listing and no fixed version, so the vendor advisory APSB26-68 should be consulted for remediation.

CVE-2026-56028 affects the Easy Elements for Elementor – Addons & Website Templates plugin for WordPress, in versions up to and including 1.4.9. The CNA Patchstack describes it as an unauthenticated privilege escalation, with a CVSS 3.1 base score of 9.8 (critical). The sources consulted do not list fixed versions, and the CVE is not in CISA KEV.

The record describes an arbitrary file upload weakness (CWE-434) in the Quform WordPress plugin for versions up to and including 2.23.0, reachable by users with the Subscriber role. The CNA Patchstack scored it CVSS 3.1 9.9 (critical). The record lists no structured fixed version and no confirmed exploitation.

CVE-2026-11720 is a path traversal flaw in the HTTP tool URL builder of Google MCP Toolbox for Databases, where dot segments in path parameters are normalized during URL resolution. The record lists the affected range as versions before 1.3.0 and links a patch pull request, and it rates the issue critical under CVSS 3.1. The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Budibase versions before 3.39.9 let a workspace-level builder upload a .zip whose icon entries are symbolic links, causing the server to read files the server process can open and expose them through an asset endpoint. The record rates the issue critical (CVSS 3.1 base score 9.6) with high confidentiality and integrity impact. No KEV listing or confirmed exploitation appears in the sources consulted, and the record states the issue is fixed in 3.39.9.

IBM WebSphere eXtreme Scale versions 8.6.1.0 through 8.6.1.6 are affected by a server-side request forgery issue triggered during Java deserialization. The record states it can be chained with a separate IBM ORB flaw to reach remote code execution, and NVD rates it critical. No confirmed exploitation appears in the sources consulted.